volhandelsburg-nl[.]live

The domain volhandelsburg-nl.live was registered on May 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the Cloudflare address 172.67.205.155, belonging to AS13335 Cloudflare, Inc., and is served from a United States edge node. The site presents a valid Let’s Encrypt certificate (issuer E7) and returns HTTP 200 over HTTP/3, indicating a fully operational web service.

The front‑end is titled “Vol Handelsburg | Officieel Platform voor AI‑ondersteunde Handel” and explicitly claims to be an exchange platform. The page mimics the Bitcoin brand, positioning itself as a fake exchange that attempts to lure cryptocurrency traders. Front‑end assets are loaded from popular CDNs such as unpkg, jsDelivr, and jQuery, while IPinfo and Cloudflare Browser Insights scripts are used for visitor analytics. These libraries are typical of opportunistic phishing kits that rely on third‑party resources to reduce hosting costs.

Threat intelligence scores reinforce the malicious nature of the site. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records a single detection out of 95 security vendors. The domain appears on one external blocklist and has already been flagged by the PhishDestroy feed, yet the site remains active as of the report date. The combination of a newly created domain, low trust rating, and active phishing classification suggests a high‑confidence indicator of a brand‑impersonation campaign targeting Bitcoin users.

Defenders should add volhandelsburg-nl.live to network and email filtering rules, enforce DNS blocklists that include the domain, and monitor Cloudflare‑associated IP ranges for similar activity. Endpoint detection should flag any attempts to load resources from unpkg or jsDelivr that resolve to the same IP. Continuous re‑verification of the domain’s status is advised, as the operator may shift hosting or regenerate certificates to evade takedown efforts.